UDM case.alertes.entities in a graph

Question

Hello,

I have been asking to do a dashboard about our Cases. It must prompt specifics cases‘s entities names but I keep struggling.

This is what I did so far, but I did not found any more information over the documentation except this https://docs.cloud.google.com/chronicle/docs/reference/soar-data-dashboard#soar-involved-entities

case.tags.name="phishing"

outcome:
$case = case.display_name
$name = case.alerts[0].entities[0].name
$type = case.alerts[0].entities[0].type

I guess that both alerts & entities are somewhat lists but I don’t understand who deep dive in it.

Thank for your time.

AbdElHafez · Answer

​@EvrardYou could use this example as a reference;match:  case.alerts.entities.identifier , case.nameoutcome:  $count=count(case.name)  $arr_alertsMeta = array(case.alerts.metadata.id)//Reference:https://cloud.google.com/chronicle/docs/reference/soar-data-dashboard#cases-and-alerts

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded